Privacy Policy

Last updated 10/16/2026

The Healthcare Professionals Registry of the United States ("HPRUS", "we" or "us") is a 501(c)(3) nonprofit organization in Washington, DC. This policy explains what personal information we collect through www.hprus.org, including when you create an account, apply for or renew a registration, pay a fee or verify a registration, and how we use, share and protect it.

In short

We collect what we need to review your application, issue and maintain your registration, and let others confirm it.
Some registration details are public on purpose: anyone with a registration number can confirm it on our Verify page.
We don't sell or rent personal information, and this site has no advertising or analytics trackers.
Service providers do parts of the work for us: Salesforce keeps our records, Heroku hosts the site, WorkOS runs sign-in, Stripe takes payments, and Google helps block spam and suggests addresses.
You can ask to see, correct or delete your information by writing to info@hprus.org.

Information we collect

Your account

When you create an account, our sign-in provider, WorkOS, confirms your email address and keeps your password, passkeys and sign-in codes. We never see or store your password. We keep your email address and name, an identifier from WorkOS, a reference code that connects your account to your registry record, and when you last signed in.

Your application

When you apply for or renew a registration, we collect the registrations you choose and your answers on the application form: your salutation, name, date of birth, ethnicity, immigration status, preferred language, mailing address, phone numbers, academic degree, the country that issued it, the year you graduated, how you heard about us and any comments. You can choose "Unknown" for ethnicity. We also collect the documents you upload, such as an identification document, your academic degree, a foreign credential evaluation and your resume.

Connecting your record

If a registry record already carries your email address, we ask for your date of birth and postal code to confirm that the record is yours, and compare them with the record.

Payments

Fees are paid on Stripe's secure checkout page. Stripe collects your card details; we never see or store them. Stripe tells us whether the payment went through, the amount and a payment reference, which we keep with your application, and emails you a receipt.

Verifying a registration

When you look up a registration, we receive the registration number you enter. To download a certificate, you enter the holder's date of birth and postal code, which we compare with the record.

Information collected automatically

Our servers record technical details of each visit, such as your IP address, your browser and the pages you request, and when. We use them to keep the site secure, to limit repeated attempts (such as wrong answers when downloading a certificate) and to fix problems.

How we use it

To create, secure and run your account.
To review your application and documents, and to issue, renew and maintain your registration. HPRUS staff review every application.
To take payments and keep a record of them.
To let anyone confirm a registration, as described under What is public.
To contact you about your account, application, payments and registration.
To prevent fraud, spam and abuse, and to keep this site and our records secure.
To meet our legal obligations.

We don't use your information for advertising.

What is public

A registry exists so that employers, licensing bodies and the public can confirm a registration. Anyone who enters a registration number on our Verify page can see the holder's salutation and name; their academic degree, specialization, country of study and year of graduation; and each of their registrations, with its type, status, number, issue date and expiration date. Downloading the certificate also needs the holder's date of birth and postal code.

The Verify page never shows your date of birth, address, contact details, ethnicity, immigration status or documents.

We don't sell or rent personal information, and we don't share it for advertising. We share it only:

With service providers that handle it for us, under our instructions:
- Salesforce, where our registry records and your documents are kept;
- Heroku, a Salesforce company, which hosts this website and its databases;
- WorkOS, which runs sign-in and sends account emails such as verification codes and password resets;
- Stripe, which processes payments and sends receipts;
- Google, whose reCAPTCHA checks for automated abuse on the Verify page and when you send an application, and whose address suggestions receive what you type in the application's address field. Google's Privacy Policy and Terms of Service apply to reCAPTCHA.
Through public verification, as described under What is public.
When the law requires it, or to protect the rights, safety or property of HPRUS, registrants or the public, for example to answer a valid legal request or to prevent fraud.
With your consent, or when you ask us to.

Signing in and paying take you to WorkOS's and Stripe's own pages, where their privacy policies apply.

Cookies

This site uses only the cookies it needs to work:

a session cookie, which keeps you signed in and remembers your progress through the application, and ends after 8 hours without activity;
a security cookie, which protects the site's forms against forged submissions.

We don't use advertising or analytics cookies. WorkOS's sign-in pages, Stripe's checkout and Google's reCAPTCHA set their own cookies under their own policies. If you block cookies, you won't be able to sign in or apply.

We don't track you across other websites, so there is nothing for a "Do Not Track" or Global Privacy Control signal to turn off.

How long we keep it

Registry records, meaning applications, registrations, documents and payment records: for as long as we need them to maintain the registry and confirm registrations, and for as long as the law requires.
Your answers on the application form stay only in your session, on our servers, until you send the application. If you stop partway, they are gone once the session ends.
Uploaded documents go straight to our records in Salesforce. This website doesn't keep a copy.
Your account, until you ask us to close it.
Server logs, for a short time, for security and troubleshooting.

How we protect it

Every page is served over an encrypted (HTTPS) connection.
Passwords are handled by WorkOS and never reach us. New passwords that have appeared in known data breaches are refused, and you can add a passkey or a second sign-in step.
Card details are handled by Stripe and never reach us.
Your account page shows only your own records, and only once your account is connected to them.
We limit repeated attempts to sign in or to guess a certificate's details.
Only HPRUS staff and service providers who need registry records can reach them.

No system is completely secure. If you think your account or information has been misused, contact us right away.

Your choices and rights

See your information. Your account page lists your registrations and applications, and you can ask us for a copy of the personal information we hold about you.
Correct it. Ask us to correct anything that is wrong. Changes to your name or date of birth go through our staff, who may ask for proof.
Delete it. You can ask us to close your account and delete your information. We delete what we can, but we may keep registry records we need to maintain or confirm a registration, or that the law requires us to keep, and we'll tell you if we do.
Withdraw an application. Contact us before it is approved.

To make a request, write to info@hprus.org or call (800) 979-2260. We'll confirm who you are before acting, and answer within 45 days. If we turn your request down, you can ask us to reconsider by replying to our answer. Depending on where you live, state privacy laws may give you these and other rights; we honor these requests wherever you live.

Children

This site is for healthcare professionals and isn't meant for anyone under 18. We don't knowingly collect personal information from children. If you believe a child has given us information, contact us and we'll delete it.

Where it is processed

HPRUS is based in the United States, and your information is processed and stored in the United States, where we and most of our service providers are. If you apply from another country, your information is transferred to the United States.

Changes to this policy

When we change this policy, we'll post the new version here and update the date at the top. If a change affects how we use information you have already given us, we'll say so on this page before it takes effect.