Privacy Policy
This policy explains what information MedReviewOps collects, why, and what choices you have. MedReviewOps provides review-response and Google Business Profile management for private practices using only publicly available information. We do not access patient records and we do not want Protected Health Information (see our Terms of Service).
1. Who we are (data controller)
The data controller responsible for your information is:
Ditta Individuale di Bonanno Andrea
Via Guido D'Orso n. 40 B, 91026 Mazara del Vallo (TP), Italy
VAT IT02897520819
Contact: andrea@getmedreviewops.com
2. Information we collect and why
a. When you contact us
Our website has no forms. When you click a "free review audit" button, your email client opens a pre-addressed message. If you send it, we receive your email address and whatever you choose to write (typically your practice name, city/state, and a link to your Google profile). We use this only to reply to you and, if you become a client, to deliver the service.
b. Analytics
When enabled, we use Google Analytics 4 (GA4) to understand aggregate traffic — pages viewed, approximate location, device and browser type. GA4 sets cookies and processes limited technical data such as a truncated IP address. We use this only to improve the site; we do not use it to identify you personally.
At the time of publication analytics is disabled by default — no Google Analytics script loads and no analytics cookies are set. If and when analytics is enabled, we will first add an appropriate cookie-consent mechanism for visitors who require one.
c. Outreach contacts
For business development we may process professional contact details of dental, medspa, and wellness practices — such as practice name, a contact person's name and role, and a business email address — obtained from publicly available sources and business data providers (for example, Apollo.io). We use this to send a small number of relevant B2B messages.
- Opt-out: every outreach email includes a way to opt out. If you ask us to stop, we stop, and we suppress your address permanently.
- Physical address: our outreach emails include the postal address listed in Section 1, in line with US CAN-SPAM requirements.
d. Client service data
To deliver the service to a practice that hires us, we work with the public content of that practice's Google Business Profile (public reviews, ratings, posts, and profile information) and the practice-voice preferences the practice shares with us during onboarding. We do not collect, request, or store patient data or Protected Health Information.
e. Billing
Payments are processed by Stripe. Stripe collects the billing details needed to charge your card (name, email, billing address, and card data). We do not store full card numbers. Stripe processes this information as an independent processor/controller under its own terms.
3. Legal bases (GDPR)
Where the EU General Data Protection Regulation applies, we rely on: performance of a contract (to deliver the service and process billing); our legitimate interests (to respond to inquiries and to conduct limited B2B outreach to relevant practices); consent (for non-essential analytics cookies, where required); and legal obligations (for tax and accounting records).
4. Who we share information with
We share information only with service providers that help us operate, each under their own terms:
- Google — to read and reply to the practice's public Google Business Profile.
- Stripe — to process payments.
- Google Analytics — for aggregate website analytics, when enabled.
- Email and outreach tools — to send and receive messages.
We do not sell your personal information.
5. How long we keep it
We keep inquiry and client information for as long as needed to provide the service and to meet legal, tax, and accounting obligations, after which it is deleted or anonymized. Outreach opt-out records are kept as long as needed to honor your request to not be contacted.
6. Your rights
Depending on where you live, you may have the right to access, correct, delete, or restrict the processing of your personal information, to object to processing, to data portability, and to withdraw consent. To exercise any right, email andrea@getmedreviewops.com. EU residents may also lodge a complaint with their local supervisory authority.
7. Cookies
The website itself sets no cookies for its core content. The only cookies are those set by Google Analytics when analytics is enabled (see Section 2b). While analytics is disabled by default, no cookies are set.
8. International transfers
The controller is located in Italy (EU) and our clients and some providers are in the United States. Information may therefore be transferred internationally, using the safeguards offered by the relevant providers.
9. Children
Our service is a business-to-business offering for private practices and is not directed to children. We do not knowingly collect information from children.
10. Changes to this policy
We may update this policy. Material changes will be reflected by updating the "Last updated" date above.
11. Contact
Questions about this policy or your information: andrea@getmedreviewops.com.