Privacy Policy
Effective date: November 2, 2026
This page explains what information Own The Contract collects, why, who we share it with, and the choices you have. "We" means Cal Marran, an Illinois sole proprietor doing business as Own The Contract.
The short version:
- We collect only what insurers need to process your applications.
- We use it only for credentialing.
- We never sell it.
- We never ask for your Social Security number or date of birth through our website form or by email.
1. What we collect
From the form on our website (when you ask us to check your insurers):
- your name and email;
- the state(s) where you're licensed;
- your license type;
- the insurers you want;
- whether you're on Headway, Alma, Grow, or another platform now; and
- anything you type in the optional comments box.
The website form does not ask for your Social Security number, date of birth, tax ID, address, or any client information. Please don't type those into it.
Through our secure intake tool (after you become a client), we collect what insurers require for credentialing. That can include:
- Identity: full legal name, other names used, Social Security number, date and place of birth, and a copy of a photo ID if an insurer asks.
- Professional IDs: NPI numbers and your CAQH ID.
- Contact details: home address, phone, and email.
- License and education: license details and copies, degrees, CV, work history, and certifications.
- Professional history: answers to standard disclosure questions (for example, discipline or malpractice history), and your malpractice insurance details.
- Practice details: practice name, addresses, hours, specialties, and languages.
- Tax information: business structure, tax ID or EIN, W-9, and IRS EIN letter.
- Bank details for insurer payments, only if an insurer needs them and you can't enter them yourself.
Our secure intake tool is a HIPAA-compliant service that we'll name in writing before you share any sensitive details.
When you pay: our payment processor, Stripe, collects your card details. We don't see or store your full card number.
When you email us: we keep the emails. Please don't put your Social Security number, date of birth, bank details, or passwords in an email. If you do, we'll delete it and ask you to resend through the secure intake tool.
What we never collect:
- Passwords. You give us access by adding us as a user, never by sharing a login.
- Patient or client information.
Our website:
- uses no cookies or ad trackers;
- loads its fonts and files from our own site, except Cloudflare's visit-count script.
We use Cloudflare Web Analytics to count visits. It doesn't use cookies or track you across sites.
Our website host may keep standard technical logs, such as IP address, browser type, and pages visited, to run and protect the site. Our host is Cloudflare Pages.
2. How we use it
We use your information only to:
- answer your request and check whether your chosen insurers look open in your area;
- prepare, submit, and follow up on your insurer applications;
- set up and keep your CAQH profile current, with you;
- keep your private status page up to date;
- take payment and handle refunds;
- send you service messages, like reminders and status updates; and
- keep records we're required to keep by law.
We never sell your information. We don't share it for advertising. We don't use it to market anything to you other than our own credentialing services, and you can tell us to stop any time.
3. Who we share it with
We share your information only as needed to do the work you hired us for:
| Who | What and why |
|---|---|
| Insurers you choose | Your application details, so they can review you. |
| CAQH (DataSpring) | Your profile details. Insurers use your CAQH profile to credential you, and only insurers you authorize can see it. |
| Government enrollment systems, like NPPES (NPI) or Medicare's PECOS, only if your application needs them | The details those systems require. |
| Our secure intake tool (HIPAA-compliant; named in writing before you share sensitive details) | It stores the documents and sensitive details you upload. |
| Stripe | Your payment, for card processing. |
| Your status page is a view-only Google Sheet shared only with you. It shows insurer names, dates, reference numbers, and status, plus redacted proof files. It never includes your Social Security number, date of birth, bank details, or passwords. | |
| Our email providers (Cloudflare Email Routing, which forwards mail sent to [email protected]; Resend, which sends our email; and Gmail, our inbox) | Everyday, non-sensitive messages. |
| Our website form provider (Formspree) | What you type into the form on our website, so it reaches us. |
| Our website host (Cloudflare Pages) | Technical logs, as described above. |
| Cloudflare Web Analytics | Visit counts, with no cookies. |
| If the law requires it | For example, a valid court order. We'll share only what's required. |
| If our business is sold or merged | Your information may transfer, under this same policy. |
These service providers may use your information only to provide their service to us.
4. How long we keep it
- Website form requests that don't become clients: deleted after 12 months.
- Sensitive intake details (Social Security number, date of birth, bank details, ID copies): deleted from our intake tool within 30 days after your last application is decided or you stop working with us.
- Other client records (applications, proof of submission, status history, emails): kept for 7 years after our work ends, so we can answer questions and handle recredentialing.
- Payment records: kept as long as tax and accounting laws require.
If you ask us to delete your information sooner, we will, unless the law requires us to keep it (see Section 6).
5. How we protect it
- Sensitive details go only through our secure, HIPAA-compliant intake tool. Never by email, text, chat, or shared folders.
- We view sensitive details inside that tool. We don't copy them into email, documents, or shared drives.
- We never ask for or store your passwords. Access is by user invites that you can remove any time.
- Your status page is shared only with you, view-only, and never contains sensitive details.
- Only Cal Marran can see your information.
No system is perfectly secure. If we learn of a breach involving your information, we'll tell you promptly and as required by law.
6. Your choices and rights
You can ask us to:
- see the personal information we have about you;
- correct anything that's wrong;
- delete your information. We'll do it, except for what we must keep by law or to finish work you've asked for, like an application already submitted;
- get a copy of your information; or
- stop non-service emails.
State privacy laws. Depending on where you live, your state's law may give you extra rights, like rights to know, delete, correct, or opt out. We don't sell or share personal information for targeted advertising. To make any request, email [email protected] with "Privacy request" in the subject. We may need to confirm your identity before we act; we'll never ask for your Social Security number to do that. We'll respond within 30 days. We won't treat you differently for making a request. You may use an authorized agent; we may ask for proof that they're allowed to act for you.
Information insurers or CAQH already have: once we've submitted an application, the insurer and CAQH keep their own copies under their own privacy policies. We can't delete those for you, but we'll tell you who to contact.
7. Children
Our service is for licensed professionals. We don't knowingly collect information from anyone under 18.
8. Changes to this policy
If we change this policy, we'll update the effective date at the top. If a change is important, we'll email current clients before it takes effect.
9. Contact us
Cal Marran, an Illinois sole proprietor doing business as Own The Contract
Chicago, IL
[email protected]