Privacy Policy

Last Updated: June 10, 2026

This Privacy Policy describes how VBC Risk Analytics, Inc. ("VBC Risk Analytics," "we," "us," or "our") collects, uses, and protects information when you use our websites and services under the NPI Data Services product line, including NPI Lookup, PECOS Lookup, NPI Registry API, Provider Signals, Provider Data Files (CSV), and Value-Based Care tools (HCC RAF). By using our services you agree to the practices described here.

1. What We Collect

Free Tools (NPI Lookup & PECOS Lookup)

When you use NPI Lookup or PECOS Lookup, we collect:

IP address — automatically logged for rate limiting, security, and abuse prevention
Browser and device information — browser type, operating system, screen resolution (via standard server logs and analytics)
Search queries — the terms you search (e.g., provider name, NPI number, specialty, city) are logged in aggregate for analytics and service improvement. We do not tie individual queries to personal identities.
Page visit data — pages viewed, referrer URL, time on page (via analytics cookies)

The free tools do not require account creation and we do not ask for your name, email, or any other identifying information to perform a search.

Paid Products (NPI Registry API, Provider Signals, Provider Data Files, HCC RAF Tools)

When you purchase or subscribe to any paid product, we additionally collect:

Name, email address, company name, phone number, and job title
IP address at registration and login
For API/SaaS products: usage data (API call volume, endpoints accessed, query patterns) for billing, abuse detection, and service improvement
For data file purchases: delivery address (email) and order history
For HCC RAF tools: member/patient count inputs submitted for scoring — these are processed in real time and not retained beyond the session

Payment information is processed entirely by Stripe, our payment processor. We never see, store, or have access to your credit or debit card numbers.

Contact Inquiries

If you email us or submit a contact form, we retain your name, email, and the content of your message to respond to your inquiry.

2. What We Do Not Collect

Protected Health Information (PHI) — none of our tools require or accept PHI. Do not submit patient data through any form or API call.
Social Security Numbers, financial account numbers, or government ID numbers
Sensitive personal categories — health, biometric, or genetic data about you

3. How We Use Your Information

To operate and improve the services
To enforce rate limits and detect abuse or fraud
To respond to support inquiries
To send transactional emails (subscription confirmations, renewal reminders) — only for paid subscribers
To send product update or promotional emails — only if you have opted in
To comply with legal obligations
To produce aggregate, non-identifiable usage statistics (e.g., "X searches per day")

We do not sell, rent, or share your personal information with third parties for their own marketing purposes.

4. Cookies and Tracking

We use cookies and similar technologies for:

Session management — to maintain your state across page loads
Analytics — aggregate traffic analysis to understand how the site is used
Security — CSRF tokens and rate-limit state

You can disable cookies in your browser settings. Disabling cookies will not prevent you from using the free lookup tools, but may affect some site functionality.

5. Data Sharing and Disclosure

We share information only in these circumstances:

Service providers: Trusted vendors (AWS for hosting, Stripe for payments, analytics providers) who process data on our behalf under contractual confidentiality obligations
Legal compliance: When required by law, court order, or valid governmental request
Business transfer: In the event of a merger, acquisition, or sale of assets, user information may be transferred to the successor entity. We will provide notice before such a transfer occurs.
Protection of rights: To protect the rights, property, or safety of VBC Risk Analytics, our users, or the public

6. Data Retention

Server access logs (IP, search queries) are retained for up to 90 days for security purposes, then deleted or anonymized
Aggregate analytics data is retained indefinitely in de-identified form
Paid account information is retained for the life of the account plus 7 years for tax and legal compliance
Contact inquiry records are retained for 2 years

7. Data Security

We use industry-standard security measures including TLS/SSL encryption for all data in transit, AWS infrastructure with restricted access controls and firewall protection, and role-based access for personnel. No internet transmission is 100% secure, and you acknowledge that you transmit information at your own risk.

8. Your Rights

Depending on your location, you may have the right to:

Request access to or a copy of personal information we hold about you
Request correction of inaccurate data
Request deletion of your personal information (subject to legal retention obligations)
Opt out of promotional communications at any time

To exercise these rights, contact us at contact@npidataservices.com. We will respond within 30 days.

9. Children's Privacy

Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us and we will delete it.

10. Third-Party Links

Our site links to third-party websites (e.g., CMS.gov, restapi.npidataservices.com, signals.npidataservices.com). This Privacy Policy does not apply to those sites. Review each site's own privacy policy before providing personal information.

11. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware. Privacy-related disputes will be resolved in accordance with the dispute resolution process described in our Terms of Use.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised version on this page with an updated "Last Updated" date. Material changes will be noted prominently. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

13. Contact

VBC Risk Analytics, Inc.
NPI Data Services
2844 Livernois Road, Suite 99553
Troy, Michigan 48099
contact@npidataservices.com