Privacy policy
What RangerMD collects, why we collect it, who else processes it, and how long we keep it — in plain language.
The short version: we store the accounts and practice data you enter into the apps. We store no patient health information. There are no advertising or analytics trackers on this site. We do not sell or share your information, and the only cookie we set is the one that keeps you signed in.
Who we are
RangerMD is an independently operated service providing two web applications — Signet and RepLink — to medical practices. This policy covers rangermd.com and its app subdomains (signet.rangermd.com, replink.rangermd.com) and the API that serves them.
What we do not collect
RangerMD operates outside your electronic health record and is not designed to store protected health information.
- We do not store patient records, diagnoses, chart data, or any clinical history.
- We do not receive data from your EHR, and we do not connect to it.
- Signet letters may contain a patient's name and dates while you fill in the form. The letter is rendered to a PDF and returned to you; those patient details are not written to our database.
- We do not use advertising networks, analytics platforms, session recording, or behavioural tracking of any kind.
What we do collect
| Category | What it includes | Why |
|---|---|---|
| Account | Your name, email address, a securely hashed password, your role, and which organization and locations you belong to. | To sign you in and determine what you are allowed to see. |
| Organization | Practice name, facility names, addresses and phone numbers, invite codes, and team membership. | To scope data to your practice and let administrators manage their team. |
| RepLink data | Sales rep and company contact details, sample inventory and quantities, dispense and drop-off records, reorder requests, weekly counts, and an activity log of actions taken in the app. | To provide the app's core function and give administrators an audit trail. |
| Signet data | Letter templates, signing provider names and credentials, practice branding, uploaded logos, and provider signature images. | To render letters on your letterhead. |
| Technical | Standard server logs kept by our hosting providers, which include IP addresses and request times. | Security, abuse prevention, and diagnosing faults. |
Cookies and browser storage
We set one cookie, named rmd_session. It is an httpOnly session cookie scoped to .rangermd.com, and it exists so that signing in to one app signs you in to the others. It is not used for tracking or advertising.
We also keep a sign-in token in your browser's local storage as a fallback for the same purpose. Signing out clears both.
Who else processes your data
RangerMD is built on third-party infrastructure. These providers process data on our behalf in order to run the service:
| Provider | Role |
|---|---|
| Supabase | Database, authentication, and file storage for uploaded logos and signatures. |
| Render | Hosting for the application programming interfaces. |
| Netlify | Hosting for the web pages themselves. |
| Resend | Delivery of transactional email, specifically team invitations. |
| Google Fonts | Serves the typeface used across the site. Loading a page requests the font from Google, which means Google receives your IP address as part of that request. |
We do not sell your data, and we do not share it with anyone for their own marketing purposes.
How your data is protected
- All traffic is encrypted in transit over HTTPS.
- Passwords are stored hashed, never in plain text.
- Data is scoped to your organization — one practice cannot read another practice's records.
- Provider signature images are held in a private storage bucket and are stamped into PDFs on the server. The signature image is never sent to the browser.
No system is perfectly secure, and we make no claim that ours is an exception. If you believe you have found a security problem, please tell us — see contact.
How long we keep it
Account and practice data is retained for as long as your organization uses the service. If you want your account or your organization's data deleted, contact us and we will remove it. Backups held by our infrastructure providers may persist for a short period after deletion.
Your choices
- Access and correction: most of your information can be viewed and edited directly in the apps under Account and Settings.
- Deletion: ask your practice administrator to remove your account, or contact us directly.
- Questions: if you want to know exactly what we hold about you, ask and we will tell you.
Children
RangerMD is a workplace tool for medical office staff. It is not intended for use by children, and we do not knowingly collect information from them.
Changes to this policy
If this policy changes materially, we will update the date at the top of this page and note it in the suite's What's new feed.
Contact
Questions about privacy, or requests relating to your data, can be sent to support@rangermd.com. More ways to reach us are on the contact page.