MedicBase helps travel healthcare professionals keep the documents that support a tax home claim. Because that means you hand us genuinely sensitive material — a lease, a driver's license, pay stubs — this policy is written to be specific rather than generic. It describes what we actually do, not what we might theoretically be permitted to do.
1. Who we are
MedicBase is operated by Indomitable Lion LLC, a limited liability company registered in Florida, United States, at 3833 Powerline Rd Suite 201, Fort Lauderdale, FL 33309. For privacy questions, write to support@getmedicbase.com.
This policy covers the MedicBase mobile application and the MedicBase website at getmedicbase.com, including its waitlist.
2. Information you give us
Account information
Your email address, and optionally your name and profession (for example RN, PT, Rad Tech). If you sign in with Apple and choose to hide your email, we receive a relay address and never see your real one.
The records you create
This is the substance of the service. It includes:
- Your declared tax home address, housing type, monthly cost and payment method
- Assignment details: facility, agency, location, start and end dates, and the taxable wage and stipend figures from your pay package
- Monthly cost entries for both your tax home and your assignment lodging
- Dates you record as nights spent at your tax home
- Documents you upload, which may include leases, mortgage statements, utility bills, a driver's license, vehicle or voter registration, bank statements, insurance documents, assignment contracts, pay stubs, lodging receipts and tax home declarations
Waitlist
If you join the waitlist on our website, we store your email address, the profession you pick, and the link that brought you to the site (for example a creator's referral link), if any. We use it to email you when MedicBase is available and to send a few launch updates. It is not linked to an app account.
Support correspondence
If you contact support, we keep the message and our reply.
3. Information collected automatically
| What | Why |
|---|---|
| Operating system, its version, and app version, attached to a support message, suggestion or issue report you send | To reproduce the problem you report |
| A few in-app events: when the subscription screen is shown and why, when a purchase completes, and when an export finishes. Plus your Readiness Score about a week after you sign up | To understand whether the app is useful and where people give up. These are stored in our own database, linked to your account, and never sent to an analytics company. They never include the contents of your documents |
| Website visits: pages viewed, referring site, country and device type, counted without cookies by Vercel Web Analytics | To see which pages and links bring visitors |
| IP address, at the moment of a request | Security, abuse prevention, and approximate country for fraud checks. Not retained as a location history |
| Subscription status | To unlock paid features. Provided to us by Apple or Google. We never receive your card number |
4. What we do not collect
Stated plainly, because in this category the absences matter:
- No bank connections. MedicBase never links to your bank accounts and never sees your transactions.
- No payment card details. Subscriptions are billed by Apple or Google. We see only whether a subscription is active.
- No background location tracking. The app does not use GPS and does not follow where you are.
- No patient information. MedicBase is not a clinical tool. See section 12.
- No contacts, no photo library scanning. We receive only the specific files you choose to upload.
- No advertising identifiers and no tracking across other apps or websites.
5. Why we process your information
| Purpose | Legal basis, where GDPR applies |
|---|---|
| Providing the service: storing, organizing and returning your records | Performance of a contract |
| Generating your readiness score, day counts and exported reports | Performance of a contract |
| Sending reminders you have enabled | Performance of a contract, or consent |
| Security, fraud prevention, and enforcing our terms | Legitimate interests |
| Fixing bugs and improving the product | Legitimate interests |
| Sending product announcements and marketing email | Consent, withdrawable at any time |
| Meeting legal and tax obligations as a business | Legal obligation |
6. Who we share information with
We use a small number of service providers. Each processes data only on our instructions and only for the purpose listed.
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database, authentication, document storage | Account data and all uploaded documents |
| Vercel | Website hosting and cookieless website analytics | Request data, IP at time of request, page views |
| Apple, Google | App distribution and subscription billing | Purchase and subscription status |
| RevenueCat | Subscription management | Anonymous user ID, subscription status |
| Resend | Support email, and launch email to the waitlist | Email address, delivery status |
We also disclose information if we are legally required to, for example in response to a valid subpoena or court order. If that happens and we are permitted to tell you, we will.
If the business is ever sold or merged, your information may transfer as part of it. You would be notified before any transfer, and any acquirer would be bound by this policy or would have to obtain your consent to depart from it.
7. How your information is protected
- All traffic is encrypted in transit using TLS
- Documents are encrypted at rest in storage
- Access is enforced at the database level through row-level security, so a request for another user's records is refused by the database itself rather than relying on application code
- The app supports a biometric lock (Face ID, Touch ID or the Android equivalent)
- Access to production systems is limited to personnel who need it, protected by multi-factor authentication
No system is perfectly secure, and we will not claim otherwise. If a breach occurs that affects your personal information, we will notify you and any required regulator without undue delay, and in any event within the timeframes the applicable law requires.
8. How long we keep it
| Data | Retention |
|---|---|
| Your records and documents, active account | Kept until you delete them. Because the IRS can look back several years, we keep your archive available rather than expiring old tax years |
| Account without an active plan | Kept until you delete your account. You can still open and export everything without a plan |
| Deleted account | Removed from live systems within 30 days. Encrypted backups are overwritten on a rolling cycle of no more than 90 days |
| Waitlist email | Until you unsubscribe or ask us to delete it, and no longer than 12 months after launch |
| Support correspondence | 24 months |
| Billing and tax records | As long as US tax law requires us to keep them |
9. Your rights
Wherever you live, you can do all of the following:
- Export everything. In the app, at any time, with or without a plan, without contacting us. You receive your documents and a machine-readable file of your records.
- Access a copy of the personal information we hold about you
- Correct anything inaccurate
- Delete your account and its contents from within the app
- Object to or restrict certain processing
- Withdraw consent for marketing email, using the unsubscribe link or your notification settings
To exercise a right that is not available in the app, email support@getmedicbase.com. We will respond within 30 days. We will not charge you, and we will not treat you differently for asking.
If you are in the European Economic Area or the United Kingdom, you may lodge a complaint with your local supervisory authority. If you are a California resident, you have the rights described in the CCPA as amended, including the right to know, delete, correct and opt out of sale or sharing — noting that we do not sell or share personal information as those terms are defined.
10. International transfers
We are a US company and our infrastructure is hosted in the United States. If you access MedicBase from outside the US, your information is transferred to and processed there. Where a transfer mechanism is required under European law, we rely on Standard Contractual Clauses with our providers.
11. Children
MedicBase is a tool for working healthcare professionals and is not directed at children. We do not knowingly collect information from anyone under 18. If we learn we have, we delete it. If you believe a minor has given us information, write to support@getmedicbase.com.
12. MedicBase and HIPAA
13. Changes to this policy
If we change this policy in a way that materially affects how we handle your information, we will notify you in the app and by email at least 14 days before it takes effect. The date at the top always reflects the current version.
14. Contact
Indomitable Lion LLC
3833 Powerline Rd Suite 201
Fort Lauderdale, FL 33309
United States
support@getmedicbase.com