Privacy policy

This policy explains what FirstPass VIP collects, why, and what we do not do with it. It is written to be read, not to be survived.

What we collect

• Account: your name and email address. We do not use passwords — you sign in with a single-use link sent to your email.
• Booking: the appointment you chose, the practice and physician, your date of birth and phone number where the practice requires them for intake, and a short reason for the visit if you provide one.
• Payment: handled by Stripe. We receive a token, the last four digits, and the card brand. We never see or store your full card number.
• Technical: a session cookie so you stay signed in, and server logs containing IP address and request paths, kept for security and debugging.

What we do with it

• Book and confirm your appointment with the practice.
• Charge fast-pass fees and membership, and issue refunds.
• Send transactional email: sign-in links, confirmations, receipts, reminders.
• Keep an audit record of bookings and payments, which we are obliged to retain.
• Detect and prevent fraud and abuse.

What we do not do

We do not sell your personal information. We do not share it with advertisers, data brokers, insurers, or employers. We do not use your booking or health-related information to target advertising.

Who we share it with

• The practice you book with — the details it needs to see you. Once you are their patient, their own privacy practices apply to your care.
• Service providers under contract, acting only on our instructions: Stripe (payments), Resend (transactional email), Vercel (hosting), and Neon (database).
• When legally required — a valid subpoena, court order, or equivalent obligation.

Health information

We collect the minimum needed to arrange an appointment. Where FirstPass VIP handles protected health information on behalf of a practice, we do so under a business associate agreement with that practice, and we apply HIPAA’s privacy and security requirements to that information.

Member features that read a prescription or an insurance card process that image only to return your result. You control whether to use them, and you can delete what you have uploaded from your account page.

How long we keep it

Account and booking records are kept for seven years, which is the retention period that applies to the financial and healthcare records involved. Sign-in tokens expire within the hour and are single-use. Server logs are kept for 90 days.

Your choices

You can ask us to show you what we hold, correct it, delete it, or send you a copy, by writing to privacy@firstpass-vip.com. We respond within 30 days. Some records we are required to retain even after you close your account; we will tell you which and why.

Florida residents, and residents of states with comparable laws, have these rights by statute, including the right not to be discriminated against for using them.

Security

Data is encrypted in transit and at rest. Sign-in tokens are stored hashed. Sessions are revocable server-side. Access to production data is limited to people who need it.

Children

FirstPass VIP is for adults. We do not knowingly create accounts for anyone under 18. An adult may book an appointment for a child in their care.

Changes and contact

We will email you before any material change takes effect. Questions go to privacy@firstpass-vip.com. See also our terms of service.