Privacy Policy

This Privacy Policy explains how OrthoFi App (orthofiapp.com) collects, uses, shares, and protects information when you visit our website. We publish independent editorial reviews of orthodontic patient financing products and operate an affiliate pre-qualification form. This policy covers both. Read our Terms of Service and Advertising Disclosure alongside this document.

1. Who we are

OrthoFi App is an independent consumer-education website owned and operated by the OrthoFi App Editorial Team. We publish research, reviews, and comparisons of orthodontic patient financing products in the United States. We are not affiliated with, endorsed by, or operated by OrthoFi, Inc., OrthoBanc, AcceptCare, CareCredit, Cherry, or any lender featured on this site. Any trademarks referenced belong to their respective owners.

For the purposes of data protection law, OrthoFi App acts as a data controller for information you provide directly through this website, and as a data processor that passes qualifying information to third-party lenders or affiliate networks when you submit the pre-qualification form.

2. Information we collect

2.1 Information you provide to us

When you use the pre-qualification form on our Apply page, you may be asked to provide the following categories of information, which are passed to our affiliate network partner APIdiamond and, downstream, to lenders in the network:

• Identity data: full legal name, date of birth
• Contact data: email address, phone number, residential address
• Government identifiers: Social Security Number (last four digits or full, depending on lender), driver's license number
• Financial data: employment status, monthly income, bank account routing and account numbers (if a loan offer is accepted), housing status
• Credit data: credit score band and credit report information retrieved by lenders during their underwriting process
• Communications: emails, messages, and any correspondence you send us (for example, corrections to editorial content or questions about our methodology)

2.2 Information collected automatically

When you visit any page on this site, we and our analytics providers automatically collect:

• Device and browser data: IP address (truncated by our analytics provider), browser type and version, operating system, device type, screen resolution
• Usage data: pages visited, time on page, scroll depth, click events, referring URL, exit page, search terms used to find the site
• Approximate location: country, state, and metro-area level location inferred from IP address (we do not collect GPS or precise location data)
• Server logs: HTTP request method, response status code, user agent, and timestamp — retained for 90 days for security monitoring

2.3 Information we do not collect

We do not collect precise GPS location, biometric data, health or dental records, protected health information under HIPAA, voice recordings, or video recordings. We do not use fingerprinting beyond what is necessary for basic analytics.

3. How we use your information

We use the information we collect for the following purposes:

Service delivery

To route pre-qualification form submissions to APIdiamond and partner lenders so they can respond with loan offers.

Analytics and improvement

To measure which pages are helpful, where users encounter friction, and which content needs updating. We use aggregated analytics data, not individual profiles.

Security and fraud prevention

To detect automated abuse, scraping, and bot traffic, and to protect site integrity.

Legal compliance

To comply with court orders, subpoenas, FTC inquiries, state attorney general requests, and other lawful demands.

Communications

To respond to corrections, questions, and complaints sent to our editorial team.

We do not use your personal information to train artificial intelligence models, to build advertising profiles for retargeting, or to sell to data brokers.

4. Legal basis for processing (EEA / UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the General Data Protection Regulation:

• Consent: for optional analytics cookies and when you voluntarily submit the pre-qualification form
• Contract: to deliver the pre-qualification routing service you request when you submit the form
• Legitimate interests: for security monitoring, fraud prevention, and site performance analytics (balanced against your privacy interests)
• Legal obligation: to respond to lawful requests from regulators and law enforcement

5. Sharing with third parties

We share information only with the categories of recipients listed below. We do not sell your personal information in the ordinary sense of the word.

5.1 APIdiamond affiliate network

Our pre-qualification form is powered by APIdiamond. When you submit the form, your information is transmitted directly to APIdiamond, which then routes it to lenders in its network based on your profile and state of residence. APIdiamond's handling of your data is governed by its own privacy policy. We receive a commission when APIdiamond or a downstream lender approves your loan.

5.2 Analytics provider

We use Statcounter to measure website traffic. Statcounter processes IP addresses, browser and device data, and page view data on our behalf. Statcounter is a Dublin, Ireland-based company and its data processing is governed by its own privacy policy and GDPR-compliant practices.

5.3 Hosting and infrastructure providers

The server infrastructure that delivers this site may be operated by Netlify, Vercel, Cloudflare, or a cPanel/Apache shared host (depending on current configuration). These providers process the technical data necessary to deliver web pages to your browser (IP addresses, HTTP requests, response bytes) under their own privacy policies.

5.4 Legal and regulatory recipients

We may disclose information when required by law, including in response to subpoenas, court orders, or regulatory investigations by the Federal Trade Commission, state attorneys general, or consumer financial protection authorities.

5.5 Business transfers

If OrthoFi App is sold or merged, user information may transfer to the acquiring entity under the terms of this policy. We will post notice at the top of this page at least 30 days before any such transfer takes effect.

6. Cookies and similar technologies

This site uses a small number of cookies and similar technologies, broken down as follows:

You can disable non-essential cookies in your browser settings. On most browsers, go to Settings → Privacy → Cookies. Disabling cookies does not affect your ability to read our editorial content; it may affect form submission.

7. Data retention

We retain different categories of data for different periods:

• Form submission metadata (page where the form was submitted, timestamp, campaign source): retained for 24 months for commission reconciliation
• Analytics data (pseudonymous page views, device data): retained by Statcounter for up to 2 years
• Server logs: retained for 90 days for security monitoring
• Email correspondence: retained for 36 months to maintain editorial accountability
• Legal records: retained for the period required by applicable law (typically 7 years for tax records)

Personal information submitted through the pre-qualification form is retained by APIdiamond and partner lenders under their own retention schedules, not ours.

8. Security

We use industry-standard safeguards to protect the information we hold:

• HTTPS encryption (TLS 1.2 or higher) for all page requests and form submissions
• HSTS (HTTP Strict Transport Security) with a one-year max-age
• Content Security Policy headers to prevent cross-site scripting and injection attacks
• No storage of Social Security numbers, bank account numbers, or payment credentials on our servers — these pass straight through to APIdiamond and partner lenders
• Regular review of third-party scripts and preconnect declarations

No system is impenetrable. If we become aware of a security incident that materially affects your personal information, we will notify affected users and relevant regulators as required by applicable law, typically within 72 hours.

9. Your rights (all users)

Regardless of where you live, you have the right to:

• Ask what information we hold about you
• Request correction of inaccurate information
• Request deletion of information we hold (subject to legal retention obligations)
• Opt out of analytics tracking by enabling your browser's Do Not Track signal, which we respect
• Opt out of future communications from our editorial team

To exercise any of these rights, email [email protected] with the subject line “Privacy Request.” We will respond within 30 days.

10. California privacy rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you additional rights:

• Right to know what personal information we collect, use, disclose, and sell
• Right to delete personal information we have collected (with exceptions for legal retention)
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing — our transfer of information to APIdiamond for affiliate pre-qualification is considered “sharing” under the CPRA. To opt out, do not submit the pre-qualification form. You can still use all editorial content.
• Right to limit use of sensitive personal information (including financial information and government identifiers)
• Right to non-discrimination for exercising any of these rights

In the preceding 12 months, we have disclosed the categories of personal information described in Section 2 to the recipients described in Section 5. We have not sold personal information for monetary consideration. We have shared pre-qualification form data with APIdiamond for the purposes of cross-context behavioral advertising attribution in the affiliate channel.

To exercise CCPA rights, submit a request to [email protected] or write to our postal address below. We will verify your identity using the information already in our records.

11. European privacy rights (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR and UK GDPR:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure, also called the “right to be forgotten” (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object to processing based on legitimate interests (Article 21)
• Right to withdraw consent at any time, where processing is based on consent
• Right to lodge a complaint with your national data protection authority

12. Children's privacy (COPPA)

Our website is intended for adults 18 years and older. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act. The pre-qualification form on our Apply page is restricted to users 18 and older. If you believe a child has submitted personal information, email [email protected] and we will delete it promptly.

Because orthodontic treatment is often financed by parents on behalf of teenage patients, our editorial content occasionally references minors as the subject of treatment. We do not collect information from or about any identifiable minor through this website.

13. International data transfers

Our servers and the servers of our analytics and affiliate partners are located in the United States and may be located in other countries. If you access this site from outside the United States, your information is transferred to, stored, and processed in the United States. Our services are intended for U.S. residents, and we do not target users in the EEA, UK, or Switzerland.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page and, for material changes, post a notice on our homepage for at least 30 days. We encourage you to review this page periodically.

15. How to contact us

For any question about this policy or your personal information:

• Privacy questions: [email protected]
• Editorial corrections: [email protected]
• Security disclosure: [email protected] (see our security.txt file for details)
• General: [email protected]

We respond to all privacy requests within 30 days of verifying your identity. For CCPA requests specifically, we aim to respond within 45 days, as permitted by the statute.