Incoming Docs Privacy Policy
Effective date: November 9, 2026 · Last updated: November 7, 2026
Incoming Docs is a service of Monadnock Cyber, LLC, Amherst, New Hampshire ("Monadnock Cyber," "we," "us"). This policy explains what personal information we collect, where it comes from, how we use and disclose it, and the rights you have. It is written to meet the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA"), the California Online Privacy Protection Act ("CalOPPA"), California's "Shine the Light" law, and the California Delete Act. We extend the same rights to everyone, wherever they live.
Incoming Docs is a business-to-business service. It is sold only to real estate professionals and firms for use in their business. It is not offered to consumers or directed to children.
In short.
- What we do. Incoming Docs uses public federal records to identify physicians who appear to be taking a job in a new area. It tells real estate professionals who subscribe, so they can offer help with the move. We use professional information only, never home addresses or personal contact details.
- How to get out. Any physician can be removed by emailing [email protected] or calling 1-888-299-6615. We remove you and keep you out, wherever you live.
- What happens if you stay in. A real estate professional licensed in your new area may contact you through your practice. Our Terms forbid them from contacting you at home and require them to follow calling and email laws.
This policy covers two groups of people:
- Part A: Physicians and clinicians whose professional information appears in the service.
- Part B: Customers and site visitors, meaning the real estate professionals who subscribe, and anyone who visits incomingdocs.monadnockcyber.ai or incomingdocs.com (the "Site").
Part A: Physicians and clinicians in the service
A1. What the service does
Incoming Docs identifies physicians and other clinicians who appear, from public federal records, to be taking a new job in a new area. It tells subscribing real estate professionals about them. For example, a practice address moved to a new state, or a new Medicare enrollment appeared in that state.
A2. What we collect, and where it comes from
We collect professional information only, from public U.S. government records:
| Category (CCPA) | What we hold | Source |
|---|---|---|
| Identifiers | Name, credential (e.g., MD, DO), National Provider Identifier (NPI) | CMS National Plan and Provider Enumeration System (NPPES), the federal NPI registry |
| Professional or employment information | Specialty; practice address and practice telephone; state license numbers and states as listed in the NPI registry; Medicare enrollment state; the medical group a clinician bills through; hospital affiliations; medical school and graduation year | NPPES; CMS Medicare provider enrollment and reassignment files; CMS Doctors and Clinicians file; CMS facility affiliation data |
| Inferences | Our assessment that a clinician has likely taken a job in a new area, with a likelihood term, a confidence level and an estimated move or training-completion window | Derived by Monadnock Cyber, by fixed rules, from the records above |
| Geolocation (coarse) | The ZIP codes of the practice locations above, used to measure how far a practice moved | Public U.S. Census Bureau ZIP-area data |
What we do not collect or sell:
- home or residential addresses (the registry's mailing address is never shown to customers);
- personal phone numbers or personal email;
- sex or gender (we deliberately do not collect the registry's sex field);
- race, religion, health information or any other sensitive personal information;
- financial account information;
- information from data breaches, data brokers or social media.
A3. Why we use it (business purposes)
- To provide the service: identify likely professional relocations and report them to subscribers.
- To check accuracy: compare records across sources, date them, and grade our confidence.
- To maintain security and prevent misuse of the service.
- To comply with law and honor removal requests.
A4. Who receives it
| Recipient | What they receive |
|---|---|
| Subscribing real estate professionals and firms | The information in A2, for their business prospecting, under contract terms that prohibit resale, screening uses and contact at a physician's home |
| Service providers (hosting, email delivery) | Only what they need to run the service for us, under contracts that limit their use |
| Authorities | When required by law |
Sale of personal information. Providing this information to subscribers for a fee is a "sale" under the CCPA. We have sold the A2 categories (identifiers, professional information, inferences and coarse geolocation) to real estate professionals and firms in the past 12 months. We do not "share" personal information for cross-context behavioral advertising. We do not knowingly sell or share the personal information of anyone under 16.
The CCPA's definition of personal information excludes information lawfully made available from government records. Much of what we hold is that kind of information. We still honor the rights below for all of it, including our own inferences.
A5. How long we keep it
- Records: we keep a clinician's record while it is current in the federal registry. When a record leaves the registry, we mark it inactive and it drops out of the service.
- Raw files: we keep raw government files for the most recent three monthly versions.
- Removal requests: if you ask to be removed, we keep only your NPI on a suppression list, so that you stay out of the service. Copies in our backups expire on our normal backup schedule; until then we do not restore or use them.
A6. Your rights
You have the right to:
- Know and access the personal information we hold about you: the categories, the specific pieces, the sources, our purposes, and the categories of recipients.
- Delete your information from the service.
- Correct inaccurate information.
- Opt out of the sale of your personal information. Use the "Do Not Sell or Share My Personal Information" link on the Site.
- Get a copy of your information in a portable format.
- Appeal. If we decline your request, our response explains why and how to appeal. Send appeals to [email protected]. If we deny your appeal, you may contact your state attorney general.
- Non-discrimination. You will not be treated differently for exercising these rights.
We have no sensitive personal information about you to limit.
Removal, regardless of where you live. Any physician or clinician can ask to be removed from Incoming Docs. We remove you from the service and keep you out of it, whether or not a law requires us to.
Global Privacy Control. We treat a browser Global Privacy Control signal as a valid request to opt out of sale for that browser and any account it is linked to.
Data broker registration. We register as a data broker in each state where the law requires it.
California Delete Request and Opt-out Platform. Where California law requires, we process deletion requests received through the California Privacy Protection Agency's Delete Request and Opt-out Platform (DROP).
A7. How to make a request
- Email: [email protected]
- Toll-free: 1-888-299-6615
Verifying your identity.
- For deletion or opt-out, we match your name and NPI to our records.
- For access or correction, we may also ask you to confirm details from your NPI registry record.
Authorized agents. An authorized agent may submit a request with your written permission. We may ask you to confirm your identity directly.
Response times.
- We confirm receipt within 10 business days.
- We respond within 45 calendar days. If we need more time (up to 45 more), we will tell you why.
- We act on opt-out requests within 15 business days.
Part B: Customers and site visitors
B1. What we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and contact information | Name, business email, business phone, brokerage or firm, account login | You, when you subscribe or contact us |
| Commercial information | Subscription plan, territory, billing history | You and our payment processor |
| Internet activity | Pages viewed, searches and filters used in the service, which leads you download and when, log data, IP address, browser type | Automatically, when you use the Site |
| Professional information | Your real estate licenses (state and number), which set the territory you may see | You; we check them against public license records |
Payment card details go directly to our payment processor. We do not store them.
B2. How we use it
- To provide and secure the service, manage your account and territory, and bill you.
- To enforce our Terms, including our limits on automated and high-speed access, download limits and territories. Each download is marked with the account it was licensed to.
- To communicate with you about the service.
- To improve the service.
B3. Who receives it
- Service providers: hosting, payment processing, email delivery and analytics, under contract.
- Authorities: when required by law.
We do not sell customer or visitor personal information. We do not share it for cross-context behavioral advertising.
B4. Cookies and tracking
- We use cookies that the Site needs to work, such as sign-in and security.
- We use limited first-party analytics to understand how the Site is used.
- We do not allow third-party advertising trackers on the Site.
Do Not Track (CalOPPA). We honor Global Privacy Control as described above. Because we use no cross-site tracking, browser "Do Not Track" signals do not change how the Site works.
B5. Retention
- Account and billing records: for as long as your account is active, then as long as tax and accounting law requires (generally seven years).
- Access logs: up to 12 months.
B6. Your rights
California residents, and everyone else, have the rights to know, access, delete and correct their information, and the right to non-discrimination. Make requests as described in A7.
Shine the Light. We do not disclose customer personal information to third parties for their direct-marketing purposes.
General
Security. We protect information with reasonable administrative, technical and physical safeguards suited to its sensitivity. This includes encryption at rest and access limited to people who need it.
Where it is processed. In the United States.
Children. The service is for businesses and is not directed to anyone under 18. We do not knowingly collect children's information.
Changes to this policy. We will post any update here with a new "Last updated" date. If the change is material, we will notify customers by email, and post a notice on the Site, before it takes effect.
Contact. Monadnock Cyber, LLC · Amherst, New Hampshire · [email protected] · [mailing address]