Privacy Policy

1. Information We Collect

a. Account Information

When you create an account, we collect your name and email address through our authentication provider, Clerk. You may also sign up using a third-party account (e.g., Google), in which case we receive the name and email associated with that account.

b. Profile Information (AMA Compliance)

After account creation, we collect the following information as required by our CPT license agreement with the AMA for royalty reporting (per Appendix D of our agreement):

• City
• State or Province
• Country
• Organization or Employer name (if applicable)

c. Usage Data

We collect data about how you use the Service, including: coding sessions and analysis results, search history and queries, saved favorites, and authorization code requests.

d. Payment Information

Payment processing is handled by Stripe, Inc. We do not store your credit card numbers or full payment details on our servers. We receive and store your Stripe customer ID, subscription status, and billing history metadata.

e. Technical Data

We automatically collect technical information including browser type and version, device information, IP address, pages visited, and interaction timestamps.

2. How We Use Your Information

We use the information we collect to:

• Provide the Service — operate, maintain, and deliver GreenCode’s coding analysis, search, and authorization features.
• Process payments — manage subscriptions and process payments through Stripe.
• Comply with AMA licensing requirements — report End User data (name, city, state, country, parent organization, number of users) to the AMA for royalty calculation and compliance, as required by Section 14.5 and Appendix D of our CPT license agreement.
• Improve the Service — analyze usage patterns to improve features and user experience using PostHog (anonymized analytics).
• Monitor for errors — detect, investigate, and resolve technical issues using Sentry (error tracking).
• Communicate with you — send service-related notices, security alerts, and support messages.

3. Information We Share

a. American Medical Association (Mandatory)

Per our CPT license agreement (Appendix A(f), Appendix A(j), and Appendix D), we are required to report the following information to the AMA for each user who accesses CPT-powered features of the Service:

• Your full name
• City, state/province, and country
• Parent organization (if provided)
• Number of users (for royalty calculation)

This sharing is mandatory and cannot be opted out of while using the Service. By using GreenCode, you consent to this data sharing as described in our Terms of Service (Sections 6 and 10).

b. Service Providers

We share information with the following third-party service providers who process data on our behalf:

• Stripe — payment processing (name, email, payment details)
• Clerk — authentication and user account management (name, email)
• PostHog — anonymized product analytics (usage patterns, no personal identifiers)
• Sentry — error monitoring and debugging (technical data, error logs)

c. We Do Not Sell Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We only share information as described in this policy.

d. Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request.

4. Data Retention

• User records and access logs: retained for a minimum of three (3) years after the year to which they pertain, as required by Section 14.7 of our AMA license agreement for audit compliance.
• Coding sessions and usage data: retained for as long as your account is active.
• Payment records: retained as required by applicable tax and financial regulations.

Deletion requests will be honored subject to our legal retention obligations under the AMA license agreement and applicable law. We will inform you if we cannot fully delete your data and explain the reason.

5. Your Rights

a. All Users

Regardless of your location, you may:

• Access your personal data by viewing your profile in the Service or by contacting us.
• Correct inaccurate profile information at any time through your account settings.
• Delete your account by contacting us, subject to our legal retention obligations under our AMA license agreement (minimum 3-year retention for audit purposes).

b. California Residents (CCPA)

If you are a California resident, you have the right to: know what personal information we collect and how it is used; request deletion of your personal information (subject to legal retention requirements); and opt out of the sale of personal information. We do not sell personal information.

c. EU/UK Residents (GDPR)

If you are located in the European Union or United Kingdom, you have the right to access, rectify, erase, restrict processing, and port your personal data. Data sharing with the AMA is based on contractual necessity (our obligation under the CPT license agreement). You may also lodge a complaint with your local data protection authority.

6. Security

We maintain reasonable and appropriate physical, technical, and administrative safeguards to protect your personal information, consistent with Section 15.2 of our AMA license agreement. These include:

• Encrypted data transmission (HTTPS/TLS)
• User registration and authentication technology (Clerk)
• Access controls and session management
• Secure cloud infrastructure

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Children’s Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will promptly delete such information.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice within the Service prior to the changes taking effect. Your continued use of the Service after such notice constitutes acceptance of the updated policy.

9. Contact Information

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact: