Privacy Notice

1. Who we are

This Privacy Notice describes how REAL Provider("we", "us") collects, uses, and shares your personal data when you use our certification, training, and verification services (the "Service"). REAL Provider is the data controller for personal data processed through the Service.

2. Categories of personal data we collect

• Account data: name, email, login credentials, organization name.
• Provider data: NPI, PTAN, taxonomy codes, practice address, and other registry information you submit for verification.
• Support data: messages, attachments, and history of communications with us.
• Usage and device data: log files, IP address, browser type, device identifiers, pages viewed, and timestamps.
• Billing-related data: the order ID and subscription status returned by Paddle. Payment card details are collected and stored by Paddle, not by us.

3. Purposes and legal basis

• Provide the Service — creating your account, running the verification process, issuing certificates (performance of a contract).
• Customer support — responding to your inquiries (contract / legitimate interest).
• Security and fraud prevention — protecting accounts and detecting misuse (legitimate interest, legal obligation).
• Product improvement and analytics — understanding how the Service is used (legitimate interest).
• Marketing communications — sending renewal and program updates (consent, where required, or legitimate interest).
• Legal compliance — meeting tax, accounting, and regulatory obligations (legal obligation).

4. How we share data

We share personal data with the following categories of recipients:

• Paddle.com — our Merchant of Record. Paddle processes payments, manages subscriptions, handles tax compliance and invoicing, and provides refund/customer-service support for all orders.
• Service providers and subprocessors — hosting, database, email delivery, analytics, and support tooling vendors who act on our instructions.
• Professional advisers — legal, accounting, and audit advisers, under duties of confidentiality.
• Authorities — where required by law, court order, or to protect rights and safety.

We do not sell your personal data.

5. Data retention

We retain personal data only for as long as needed for the purposes described above — typically for the life of your account plus a reasonable period to comply with tax, accounting, and legal-record obligations. When no longer needed, data is deleted or anonymized.

6. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict processing of, or port your personal data, and to object to certain processing or withdraw consent. To exercise these rights, email privacy@real-provider.org. For billing-related data held by Paddle, you can also contact Paddle directly at paddle.net.

7. Security

We use appropriate technical and organizational measures — including encryption in transit, access controls, and least-privilege practices — to protect personal data against unauthorized access, alteration, disclosure, and destruction.

8. Cookies

We use strictly necessary cookies to keep you signed in and to maintain session integrity. We may also use limited analytics cookies to understand aggregate usage. You can manage cookies through your browser settings.

9. Contact

REAL Provider — privacy@real-provider.org.