Home / Privacy

Privacy

Draft, pending legal review.

This page was last updated on November 1, 2026.

MedLicense is built so that we do not hold your information. This page describes what the app and this website do with it.

The app

• The app has no account and no server. You do not sign up, and there is no MedLicense server that receives your records or documents.
• Your records are encrypted on your device. The vault and every attached document are sealed with AES-256-GCM, and the vault key is kept in your device's own secure key store, such as the Keychain on a Mac or iPhone.
• Sync is optional. If you turn it on, MedLicense keeps the vault in a private app folder in your own OneDrive after you sign in with Microsoft, or in any folder you choose. Either way, that service receives encrypted files only.
• Your recovery passphrase protects a second copy of the key. MedLicense derives a key from it with PBKDF2-SHA256 at 310,000 iterations. The passphrase is never stored, so if you lose it and your device, the vault cannot be opened.
• You can lock the app. Face ID or Touch ID can lock MedLicense whenever you leave it.
• Documents are read on your device. Text recognition happens locally, so the contents of your documents are not sent anywhere.
• Registry checks are the only other online features. If you ask for them, MedLicense looks up your NPI in the public NPPES registry and downloads the public OIG exclusion list to compare against your name, and nothing else about your vault is sent.
• The app sends no analytics. Reminders are scheduled on your device, and no usage data is reported to us.

Requirement data

State CME and renewal requirements were compiled for planning and may be out of date or wrong, so always confirm them with the relevant board. MedLicense is not legal or compliance advice.

This website

• This website sets no cookies and runs no analytics or advertising scripts.
• The fonts, Gloock and Schibsted Grotesk, load from Google Fonts, so your browser contacts Google to fetch them.
• The hosting provider, Cloudflare, may keep ordinary server logs.

Free tools on this website

• The state pages, planner and calculator run in your browser. The requirement and fee data is downloaded with the page, and the states and months you choose are not sent to us.
• The NPI lookup page contacts the public NPPES registry. Your browser sends the number you type to npiregistry.cms.hhs.gov, and that government service sees your network address and the number. We do not receive it.
• The free tracker templates are plain CSV files that contain no personal data until you add it yourself.

For how credential and health-related records are treated in the app, read health data privacy. These pages are drafts and are pending legal review.

Questions

If something here is unclear, please ask before you rely on it, using the route described on the contact page.