Legal
Privacy Policy
Last updated: July 6, 2026
Curacheck ("Curacheck", "we", "us"), a product of DRX Consulting Group, LLC, provides provider-legitimacy and discount-eligibility verification. This policy explains what personal information we handle and why. It applies to our website and the verification service at app.curacheck.io.
Who controls your data
When a business (a "merchant" or "organization") uses Curacheck to verify providers, that organization is the controller of the provider records it collects, and Curacheck acts as its service provider / processor. For our own website and account holders, Curacheck is the controller.
Information we handle
- Identity verification data. To confirm a provider's identity we use a third-party identity provider (Stripe Identity). Document images and biometric selfie data are collected and processed by that provider; Curacheck receives only the outcome and limited verified attributes (e.g., name, and the state on the ID) — not the document images.
- Professional data. National Provider Identifier (NPI) and the associated public registry record (NPPES), and public exclusion-list results (OIG LEIE, SAM.gov).
- Contact data. Email address, and any name or practice details a provider or organization submits.
- Account & usage data. Login identifiers, audit records of actions in the dashboard, and standard technical logs.
How we use it
- To verify provider legitimacy and eligibility and return a decision to the organization.
- To deliver eligibility outcomes to the organization's connected systems (e.g., a storefront or webhook). We share outcomes and reason codes only — never verification internals or document images.
- To continuously re-screen exclusion status and revoke eligibility when it changes.
- To operate, secure, and support the service, and to meet legal obligations.
Sharing
We share personal information with: the organization that requested the verification (outcomes only); subprocessors that operate the service on our behalf (identity verification, cloud hosting, database, and email delivery), under contract; and authorities where required by law. We do not sell personal information.
Retention
We retain verification outcomes for as long as the organization maintains its account or as required for audit and legal purposes, and delete or de-identify personal data on a valid request (see below). Document images are retained by the identity provider under its own policy.
Your choices & rights
Depending on your location, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing. Providers should contact the organization that requested their verification; you may also contact us and we will route the request appropriately. Merchant-initiated data requests and deletions (including Shopify's customers/data_request, customers/redact, and shop/redact) are honored.
Security
We use encryption in transit and at rest, scoped access, tenant isolation, and signed, verifiable webhooks. No method of transmission or storage is perfectly secure, but we work to protect your information.
Contact
Privacy questions or requests: privacy@curacheck.io.
Drx Consulting Group, LLC · 2114 N Flamingo Road #2423 · Pembroke Pines, FL 33028-3501 · United States.