Privacy Policy

Last updated February 2026

Introduction

Geo-Metric Procurement ("we," "our," or "the Platform") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our B2B durable medical equipment procurement platform.

Information We Collect

Account Information

When your organization registers for an account, we collect:

Full name and job title
Business email address
Organization name and facility details
Business phone number
Shipping and billing addresses

Net 30 Credit Application Data

If your organization applies for Net 30 credit terms, we additionally collect:

Legal business name and business address
Employer Identification Number (EIN)
National Provider Identifier (NPI) number
State license number
Accounts payable contact information
Business type, years in business, and estimated monthly spend

These sensitive identifiers are encrypted at rest using industry-standard Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256 integrity verification) and are accessible only to authorized operations staff for the purpose of credit evaluation.

Transaction Data

When you place orders through the Platform, we collect information related to your purchases, including product selections, order quantities, pricing, and shipping details. Payment processing is handled by our third-party payment processor, Stripe. We do not store full credit card numbers on our servers.

Usage Data

We automatically collect certain information when you access the Platform, including browser type, IP address, pages viewed, and access timestamps. This data is collected through server logs and session cookies.

Behavioral and Analytics Data

To improve product relevance and user experience, we collect:

Search queries and search result interactions
Product autocomplete selections
Cart activity (items added, removed, or modified)
Quote request and checkout flow events

This data is associated with your account when you are logged in, or stored anonymously for unauthenticated sessions.

If your browser sends a Global Privacy Control signal (Sec-GPC: 1) or Do Not Track signal (DNT: 1), we suppress behavioral event logging for that request.

Security Data

For account security purposes, we record:

This information is used to detect unauthorized access and to notify you of new sign-ins from unrecognized devices or locations.

Communications

We retain messages sent through our in-platform messaging system between your account and our operations team, including order-related inquiries and after-sales requests.

How We Use Your Information

We use the information we collect to:

Process and fulfill your durable medical equipment orders
Manage your account and provide customer support
Communicate regarding order status, shipments, and after-sales requests
Generate invoices and process refunds
Improve the Platform and our service quality
Comply with legal obligations

Information Sharing

We do not sell your personal information. We share information only in the following circumstances:

Vendors and suppliers: We share order details (shipping address, product selections, quantities) with our equipment vendors solely to fulfill your purchase orders.
Payment processors: Transaction data is shared with Stripe for payment processing.
Shipping carriers: Delivery addresses and contact information are shared with carriers (UPS, FedEx, USPS, DHL) to complete shipments.
Shipment tracking: We use AfterShip to provide real-time delivery tracking. Tracking numbers and carrier information are shared with AfterShip for this purpose.
Address verification: When you enter a shipping address, we may use the Google Places API to provide address suggestions. Your typed input is sent to Google in real time for autocomplete purposes. This is governed by Google's Privacy Policy.
Legal requirements: We may disclose information when required by law, subpoena, or other legal process.

Data Retention

We retain your account information and transaction history for as long as your account is active and for a reasonable period thereafter to comply with our legal and business obligations. Order records are retained for a minimum of seven years for tax and regulatory compliance purposes.

Operational telemetry is retained on a shorter schedule aligned to purpose: behavioral event logs are retained for 365 days, successful webhook delivery records are retained for 365 days, closed privacy requests are archived for 730 days, and public contact attachments are retained for 180 days before scheduled cleanup, unless a longer period is required for security, dispute resolution, legal obligations, or active support.

Data Security

We implement industry-standard security measures to protect your information, including encrypted connections (TLS/SSL), secure authentication, and access controls. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

Your California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

Right to know: You may request information about the categories and specific pieces of personal information we have collected about you.
Right to delete: You may request deletion of your personal information, subject to certain exceptions.
Right to opt out: You have the right to opt out of the sale of your personal information. We do not sell personal information.
Right to correct: You may request correction of inaccurate personal information we maintain about you.
Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, signed-in users can submit and track requests in Privacy Requests. You may also contact us through our Contact page.

We assign due dates and track request status internally to support statutory response windows. Our standard initial response target is 45 days, and any extension is handled through the tracked request workflow with a recorded reason.

For signed-in requests, we rely on the authenticated account session as the default verification control before fulfilling access, deletion, correction, or opt-out actions. If we detect signs of account compromise or conflicting account-control evidence, we may pause fulfillment and request additional verification before completing the request.

Do Not Track / Global Privacy Control

If your browser sends DNT: 1 or Sec-GPC: 1, we treat that request as a signal not to record behavioral product-analytics events for that interaction. This suppression affects product-behavior logging and does not disable functionality required to operate the platform, process orders, secure accounts, or comply with legal obligations.

Children's Privacy

The Platform is designed for business use by authorized procurement professionals. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have collected information from a minor, we will promptly delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Platform after changes constitutes acceptance of the revised policy.

Contact

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please reach out through our Contact page.