Privacy Policy

Effective September 27, 2026

This Privacy Policy explains how JE Design Studio Inc. ("NPILayer", "we", "us") collects, uses, and shares information when you use npilayer.com, our free lookup tools, and the NPILayer API at api.npilayer.com (together, the "Service").

The short version: we collect the minimum needed to run accounts, billing, and the API. We do not sell personal information. The provider records we serve are public NPPES data published by CMS, not data collected from you.

1. Information we collect

Account information

When you create an account we collect your name and email address, and you choose a password. Passwords are stored only as a salted one-way hash. We cannot see or recover your password.

API keys

When you create an API key we show it to you once. We store only a hash of the key and a short, non-secret prefix so you can identify it in your dashboard. We cannot retrieve a full key after creation.

Usage data

To enforce plan limits and show you your usage, we record aggregated counts of API requests per key, per endpoint, per response status, per day. To enforce the per-minute burst limit we also keep short-lived request timestamps, which are deleted within minutes. We do not store a permanent log of every API request in our application database.

Billing information

Payments are processed by Stripe. Your card details go directly to Stripe and are never stored on our servers. We store your Stripe customer and subscription identifiers, your plan, and your billing period dates so we can apply the correct limits.

Search queries

Queries you send to the API or enter in the free lookup tools (for example an NPI, a provider name, or a ZIP code) are used to return results. We do not link free lookup tool searches to an identity. Do not include patient or other sensitive personal information in queries; see Section 7.

Technical data and server logs

Like most websites, our web server keeps standard access logs that can include your IP address, the time of the request, the requested URL (including query string), your browser's user agent, and the response status. We use these logs for security, abuse prevention, and troubleshooting.

Cookies and local storage

Necessary. These are required for the Service to work and are always on:

ci_session: keeps you signed in to your account.
csrf_cookie_name: protects forms such as sign-in and account actions from cross-site request forgery.
cc_cookie: remembers your cookie choices so we do not ask on every visit.
npi-theme (in your browser's local storage, not a cookie): remembers whether you chose light or dark mode. It is never sent to our servers.

Analytics. We use analytics tools, such as Google Analytics, that may set cookies to measure aggregate usage. In the EU, EEA, UK, Switzerland, Brazil, and Canada, they stay off until you accept the Analytics category in the cookie banner; elsewhere, they are on by default and you can turn them off. Google determines your region from your connection; we do not look up your location. Google's tags respect your choice through Google Consent Mode. You can change your choice at any time using the Cookie Preferences link in the footer of any page.

We do not use advertising cookies.

Analytics

Unless the Analytics category is off for you as described above, we measure aggregate product activity, such as page views and events like account signups, to understand how the Service is used. We do not send API keys, provider phone numbers, or search query contents to analytics tools. If the category is off, these tools do not collect analytics data about your visit.

Fonts

Our pages load the Inter typeface from Google Fonts. When your browser fetches it, Google receives your IP address and standard request information under its own privacy policy.

2. How we use information

To create and secure your account and authenticate API requests
To provide the Service, enforce rate limits and monthly quotas, and show you your usage
To process payments and manage subscriptions
To send transactional email such as account, billing, and security notices
To respond to support requests
To detect and prevent abuse, fraud, and security incidents
To maintain and improve the Service
To comply with legal obligations

We do not use your information to train advertising profiles, and we do not send marketing email unless you have asked to receive it.

3. How we share information

We do not sell your personal information. We share it only as follows:

Stripe, to process payments and manage subscriptions.
Resend, to deliver transactional email. It receives your email address and the content of messages we send you.
Infrastructure and hosting providers that store and serve our application and database on our behalf.
Legal and safety: when required by law, legal process, or to protect the rights, property, or safety of us, our users, or others.
Business transfers: if we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, and we will tell you if your information becomes subject to a different privacy policy.

4. Provider data (NPPES)

The healthcare provider records in the Service come from the National Plan and Provider Enumeration System (NPPES), published by the Centers for Medicare & Medicaid Services (CMS). This is public data. We did not collect it from you, and it is separate from your account information.

If you are a provider and a record contains inaccurate information, the correction must be made at the source by updating your NPPES record at nppes.cms.hhs.gov. Our copy is refreshed from CMS files on a regular schedule, so corrections will appear after the next update. We cannot remove an active NPPES record from the Service while CMS publishes it. For deactivated NPIs we follow CMS dissemination guidance.

Provider information is based on publicly available NPPES data. An NPI does not indicate licensure, credentialing, network participation, or current practice status.

5. Data retention

Account information is kept while your account is open.
Aggregated usage counts are kept while your account is open so you can review usage and so we can resolve billing questions.
Burst-limit request timestamps are deleted within minutes.
Server logs are kept for a limited period for security and troubleshooting.
Billing and tax records are kept as long as the law requires.

When you ask us to delete your account we delete or de-identify your personal information, except where we must keep it for legal, tax, security, or fraud-prevention reasons.

6. Security

We use HTTPS in production, store passwords and API keys only as hashes, protect forms against cross-site request forgery, and let you revoke API keys at any time from your dashboard. No system is perfectly secure. If you believe your account or an API key has been compromised, revoke the key and contact us right away.

7. Protected health information

The Service is designed for public provider directory data. It is not intended to receive protected health information (PHI) or other patient data, and we do not sign business associate agreements. Do not include patient information in API requests or lookup queries.

8. Your choices and rights

You can review and update your account details, and revoke API keys, from your dashboard. You can also email us to request access to, correction of, or deletion of your personal information. Depending on where you live, you may have additional rights under local law, such as the right to know what we hold about you, to object to certain uses, or to lodge a complaint with a regulator. We will not discriminate against you for exercising those rights. We may need to verify your identity before acting on a request.

9. Children

The Service is intended for business and developer use and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

10. International use

We operate in the United States and the Service is hosted in the United States. If you use it from another country, your information will be transferred to and processed in the United States.

11. Changes to this policy

We may update this policy from time to time. When we make a material change we will update the effective date above and, where appropriate, notify you by email or in the Service.

12. Contact

JE Design Studio Inc.
Email: [email protected]