Privacy Policy

1. Information We Collect

We collect the following categories of personal information when you use FQHC Talent:

Identifiers: Your name, email address, phone number, and city/region. This is collected when you sign up for our candidate waitlist, employer waitlist, displaced worker fast-track program, or early access list.

Professional information: Job titles, work history, employer names, education history, skills, EHR system experience, certifications, language abilities, and professional objectives. This is collected when you use our resume builder tool.

Resume files: If you upload a resume (PDF or DOCX format), we store the file and extract text from it to help pre-fill your profile. Uploaded resumes are stored securely in a private storage bucket and are not publicly accessible. Temporary access links expire after one hour.

Employer information: Organization name, website, contact person details, EHR system, and job opening details. This is collected when employers submit hiring interest or use our offboarding intake and locum tenens request forms.

Career assessment responses: Your answers to our career insights assessment questions and the resulting scores. This helps us understand your professional strengths and recommend suitable roles.

Manager and team assessment data: If you use our Team Readiness or OKR assessment tools, we may collect your responses, resulting scores, domain assessments, and session identifiers to provide personalized results and track team readiness over time.

Newsletter subscription data: When you subscribe to our newsletters (Intel Brief for FQHC leaders and/or The Pulse for job seekers), we collect your email address, audience preference, and optionally your region, role type, primary challenge, organization size, and content preferences. We also track your subscription status (active or unsubscribed) and your position in any automated email drip sequences.

Learning and course progress: When you use our Academy courses (such as the OKR Course), learning pathways, or interactive simulators, your progress, completed modules, and earned XP are stored locally in your browser (localStorage). If you choose to save your progress (by providing your email), we sync this data to our servers so you can pick up where you left off on any device. You are never required to sync — local-only progress works just fine.

Tool usage data: When you use our interactive tools (simulators, OKR templates, resume builder, career assessment, learning pathways), we collect anonymous usage events — such as which tool you used, which template you downloaded, or which simulator scenario you ran. This helps us understand which tools are most valuable so we can keep improving them. If you provide your email (for example, to save your progress or download results), we associate that event with your email. We never track tool usage without your active interaction — we track actions you take, not pages you view.

Feedback: If you use our feedback widget, we collect the page URL, feedback type, your message, and optionally your email address.

Locum tenens information: If you register as a locum provider, we collect your name, email, professional role, license number, availability, region, and EHR experience. If you request locum coverage as a facility, we collect your facility name, contact information, roles needed, timeline, and budget.

Account information: If you create an account using our authentication system (email/password or Google OAuth), we store your user ID, display name, professional role, organization, region, and onboarding status. Supabase manages authentication tokens and session cookies.

Content reading progress: If you are logged in, we automatically track which content you view (guides, masterclasses, research articles, blog posts) and how far you have progressed. This powers your personalized dashboard and Library tab, showing you what you have read and what you are still reading. This tracking only occurs for authenticated users — anonymous visitors are not tracked. You can see and manage your reading history in your dashboard.

Saved content: If you are logged in, we may store your bookmarked content (favorites) and saved job listings (watchlist) linked to your user account.

Usage data: We use Google Analytics 4 to collect anonymized data about how visitors interact with our site, including pages visited, time on site, general geographic region, device type, and referral source. This data is aggregated and does not personally identify you.

Technical data: IP addresses are temporarily processed for rate limiting and abuse prevention. We do not store IP addresses in our database or associate them with your profile.

2. How We Use Your Information

We use the information we collect for these specific purposes:

Career tools and resources: To provide free career tools, aggregated job postings, salary intelligence, and strategic resources for community health professionals exploring opportunities at Federally Qualified Health Centers (FQHCs) in California.

Resume generation: To generate a formatted resume document (PDF) based on the information you provide in our resume builder. The resume is generated locally in your browser — your resume PDF is not stored on our servers.

Newsletter delivery: To send you our newsletter publications based on your subscription preferences. We operate two newsletter tracks: Intel Brief (strategic intelligence for FQHC leaders) and The Pulse (career updates for job seekers). We may also send you a short automated welcome sequence (drip emails) over 2-3 weeks after you subscribe to help you get the most value from the platform. Every email includes a one-click unsubscribe link.

Academy and learning tools: To provide interactive courses, simulators, and educational content through our FQHC Academy. Course progress is tracked locally in your browser by default. If you choose to save your progress with your email, we store it server-side so you can resume on any device. Assessment results from tools like Career Insights and Team Readiness may be stored to provide personalized recommendations.

Tool improvement: To understand which tools, templates, and features are most used and most valuable. We analyze anonymous tool usage patterns (such as: which OKR templates are downloaded most, which simulator scenarios are run most often) to prioritize improvements. This data is aggregated — we care about trends, not individual behavior.

Communications: To send you a confirmation email when you sign up, and to send relevant job opportunities, platform updates, and career resources. Every email includes an unsubscribe option.

Employer notifications: To notify our team when a new employer or candidate signs up, so we can follow up and facilitate introductions.

Locum tenens matching: To connect healthcare facilities needing temporary providers with available locum professionals. Provider and facility information is used solely for this matching purpose.

Platform improvement: To understand how people use our site so we can make it more helpful. We analyze aggregated usage patterns, not individual behavior.

Abuse prevention: To enforce rate limits and prevent spam or automated abuse of our forms.

3. Information Sharing and Disclosure

We do not sell your personal information. We have never sold personal information, and we have no plans to do so.

We do not share your data with advertisers, data brokers, or any third parties for marketing purposes.

We do not share candidate profiles with employers. The information you provide through our career tools (resume builder, assessments) is used solely to generate your career documents and insights. Your data stays with you.

We use the following third-party service providers to operate our platform. These providers process data on our behalf and are contractually obligated to protect it:

Supabase: Database hosting and file storage (servers located in the United States). Stores your profile information and uploaded resumes.

Resend: Email delivery service. Processes your email address and name to send confirmation and notification emails.

Vercel: Website hosting and server-side processing. Processes requests to our site including form submissions.

Google Analytics 4: Anonymized website analytics. Collects aggregated usage data via cookies. Does not receive your name, email, or any personally identifiable information from us. Analytics data may be shared across our domains (fqhctalent.com and healthcaretalent.org) for a unified understanding of site usage.

Calendly: If you choose to book a call or briefing through our scheduling links, you will be redirected to Calendly, a third-party scheduling service. Calendly collects your name, email, and any information you provide during booking. Calendly's privacy policy is available at calendly.com/privacy.

Cloudflare: DNS and email routing services. Processes domain-level traffic and routes incoming emails to our team.

For more information about how our service providers handle your data, you can review their respective privacy policies: Supabase (supabase.com/privacy), Resend (resend.com/legal/privacy-policy), Vercel (vercel.com/legal/privacy-policy), and Google Analytics (policies.google.com/privacy).

We may disclose your information if required by law — for example, in response to a valid court order, subpoena, or government request — or if we believe disclosure is necessary to protect the safety of our users, the public, or our platform.

4. Your Rights Under California Law (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) give you specific rights regarding your personal information:

Right to know: You can request that we disclose what personal information we have collected about you, the categories of sources, the purpose for collecting it, and the categories of third parties we have shared it with.

Right to delete: You can request that we delete the personal information we have collected from you. Upon receiving a verified request, we will delete your information from our systems within 45 days, except where we are required by law to retain it.

Right to correct: You can request that we correct inaccurate personal information we have about you.

Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of in this regard.

Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights. You will receive the same quality of service regardless of whether you exercise your rights.

Right to limit use of sensitive personal information: We do not collect sensitive personal information as defined by the CPRA (such as Social Security numbers, financial account numbers, precise geolocation, racial/ethnic origin, or health information beyond professional certifications).

To exercise any of these rights, email us at privacy@fqhctalent.com with the subject line "Privacy Rights Request." We will verify your identity by confirming the email address associated with your account. We will respond to your request within 45 days as required by California law. You may also designate an authorized agent to make a request on your behalf.

5. Do Not Sell My Personal Information

We do not sell your personal information to third parties. This includes both traditional sales for money and "sharing" personal information for cross-context behavioral advertising as defined by the CPRA.

We do not use your data for targeted advertising, retargeting, or to build advertising profiles. We do not participate in data broker networks.

If our practices ever change, we will update this policy and provide you with the opportunity to opt out before any sale or sharing occurs.

6. Data Retention

We retain your personal information only as long as necessary for the purposes described in this policy:

Candidate and employer profiles: Retained for as long as you wish to remain active on our platform. You may request deletion at any time.

Resume files: Uploaded resume files are retained for as long as your profile exists. When you request deletion of your profile, your uploaded resume file will also be deleted.

Newsletter subscriptions: Your email address and subscription preferences are retained while your subscription is active. When you unsubscribe, we update your status to "unsubscribed" and retain only the email and status for suppression purposes (to prevent re-sending). You may request full deletion of your subscriber record at any time.

Assessment and course data: Career assessment results, team readiness assessments, and other tool-generated data are retained as long as your profile exists. Locally stored course progress (in your browser) persists until you clear your browser data. Server-synced course progress (if you opted in by providing your email) is retained until you request deletion.

Tool usage events: Anonymous tool usage data (which tools and templates you used) is retained for up to 24 months for product improvement analytics. If you provided your email with a tool event, you may request deletion at any time.

Locum tenens registrations: Provider availability and facility requests are retained as long as they remain relevant. You may request deletion at any time.

Feedback submissions: Feedback you submit through our feedback widget is retained indefinitely to help us improve the platform. If you included your email, you may request deletion.

Email communications: Transactional email logs (confirmations, notifications, newsletter sends) are retained by our email provider (Resend) for up to 30 days for delivery troubleshooting. We also maintain an internal log of newsletter sends (date, recipient count, track) for operational purposes.

Analytics data: Google Analytics data is retained for 14 months in aggregated, anonymized form. This data cannot be used to identify you individually.

Rate limiting data: IP-based rate limiting data is stored in temporary server memory and is automatically cleared within minutes. It is never written to a database.

If you request deletion of your account and data, we will remove your information from our active databases within 45 days. Some information may persist in encrypted backups for up to 90 days before being permanently deleted.

7. Data Security

We take the security of your personal information seriously and implement the following measures:

All data transmitted between your browser and our servers is encrypted using TLS/HTTPS.

Our database uses row-level security policies to restrict access. API routes that handle your data use a secure server-side key that is never exposed to browsers.

Form inputs are validated and sanitized on both the client and server to prevent injection attacks.

We implement rate limiting on all form submission endpoints to prevent automated abuse.

Security headers are configured on all pages (including protections against clickjacking, content sniffing, and cross-site scripting).

Access to our production database and hosting infrastructure is restricted to authorized personnel only.

While no system is 100% secure, we take reasonable and appropriate measures to protect your data from unauthorized access, loss, misuse, or alteration. If we become aware of a data breach that affects your personal information, we will notify you and the appropriate authorities as required by California law (Cal. Civ. Code § 1798.82) within 72 hours of confirming the breach.

8. Cookies and Tracking Technologies

We use the following cookies and tracking technologies:

Google Analytics 4: Uses first-party cookies to collect anonymized usage statistics. These cookies do not contain personal information and are not used for advertising. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout). You can also decline analytics cookies via our cookie consent banner.

Authentication cookies: If you create an account or log in, our authentication provider (Supabase) sets secure session cookies to keep you logged in. These are strictly necessary for account functionality and are not used for tracking.

Essential cookies: We use minimal cookies necessary for site functionality, including language preference (English/Spanish) and cookie consent status. These are strictly necessary and cannot be disabled.

Local storage: We use your browser's localStorage to save your learning progress (e.g., OKR course completion, learning pathway steps), cookie consent preferences, and analytics opt-out preferences. This data stays on your device and is not transmitted to our servers.

We do not use: Third-party advertising cookies, cross-site tracking pixels, social media tracking widgets, fingerprinting technologies, or any form of behavioral advertising technology.

We respect Do Not Track (DNT) browser signals. When we detect a DNT signal, no analytics tracking is initiated for that session.

9. Children's Privacy

FQHC Talent is a professional career platform intended for adults (18 years of age and older). We do not knowingly collect personal information from children under 13 years of age as defined by the Children's Online Privacy Protection Act (COPPA), or from minors under 16 as defined by the CCPA.

If we discover that we have inadvertently collected information from a child under 13, we will promptly delete that information from our systems. If you believe that a child under 13 has provided us with personal information, please contact us at privacy@fqhctalent.com.

10. International Users

FQHC Talent is operated in the United States and is intended for users in the United States, primarily in California. Our servers and data storage are located in the United States.

If you access our platform from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. By using our platform, you consent to this transfer. The data protection laws in the United States may differ from those in your country of residence.

11. Third-Party Links

Our platform may contain links to external websites, including FQHC careers pages, job application portals, and professional resources. These third-party sites have their own privacy policies, and we are not responsible for their content or data practices.

When you click a link to an external site, you are leaving FQHC Talent. We encourage you to review the privacy policy of any third-party site before providing your personal information.

12. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or have a concern about how we handle your information, please contact us:

Privacy requests: privacy@fqhctalent.com

General inquiries: info@fqhctalent.com

Please include "Privacy" in the subject line so we can route your request promptly. We aim to respond to all privacy-related inquiries within 10 business days.

13. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page.

For significant changes that affect how we use or share your personal information, we will make reasonable efforts to notify you in advance — for example, by posting a notice on our website or sending an email to the address associated with your account.

We encourage you to review this page periodically to stay informed about how we protect your information.