Last Updated: October 28, 2026
NDD MSO LLC (DBA NextDayDoctor) ("NextDayDoctor," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, mobile application, and related services (collectively, the "Platform").
Please read this Privacy Policy carefully. This Policy is a notice describing our privacy practices; it is not a request that you agree to uses or disclosures of health information beyond those permitted by applicable law. Where consent or authorization is required for a particular collection, use, or disclosure, we will request it separately before that activity occurs. Your access to and use of the Platform are governed by the Terms of Service.
NOTICE REGARDING HEALTH INFORMATION: This Privacy Policy covers personal information collected through your use of our website and platform technology. If you receive healthcare services through NextDayDoctor, the use and disclosure of your Protected Health Information ("PHI") is separately governed by the Notice of Privacy Practices issued by Tristan Cooper MD PLLC (the "Medical Practice"). Please review that notice carefully. Where this Privacy Policy and the Notice of Privacy Practices address the same information, the Notice of Privacy Practices controls with respect to PHI.
NDD MSO LLC (DBA NextDayDoctor) operates as a Management Services Organization ("MSO") — a technology and administrative services company. We do not practice medicine. Medical services are provided by the Medical Practice and its independently licensed healthcare providers.
As a Business Associate to the Medical Practice — Tristan Cooper MD PLLC, DBA NextDayDoctor Medical Group — under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations, NextDayDoctor handles PHI only as permitted by HIPAA and our Business Associate Agreement with the Medical Practice. We maintain administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI.
Business Associates: Our direct Business Associate relationship is with the Medical Practice. Subprocessors and subcontractors who access PHI on behalf of an entity in the Business Associate chain — including cloud infrastructure providers — are required to enter into a Business Associate or subcontractor agreement with the entity that engages them in that chain, obligating them to protect PHI to the same HIPAA standard.
Your medical records rights are described in the Notice of Privacy Practices. These rights survive account termination — closing your account does not extinguish your right to access or obtain copies of your medical records. Requests for medical records should be directed to the Medical Practice as described in the Notice of Privacy Practices.
PHI and account deletion: Closing an account does not authorize deletion of Patient Records before the Medical Practice's voluntarily adopted ten-year clinical-record period, any longer applicable legal period, or any preservation hold has expired. HIPAA does not establish a general ten-year or six-year medical-record retention period. Nevada law separately requires at least five (5) years after receipt or production and prohibits destruction while the person who is the subject of the records is under age twenty-three (23). We may therefore deny or defer a deletion request for clinical PHI while retention is required or permitted for a lawful purpose.
We collect information you voluntarily provide when using the Platform, including:
When you use the Platform to access telehealth services, we collect and handle:
We use AI-assisted services supplied through HIPAA-eligible technology providers operating under written Business Associate Agreements. Staff-facing tools assist with real-time transcription, clinical-documentation drafts, information lookup, and care coordination. Treating Providers review and approve clinical documentation before it becomes part of a patient record.
The Platform also includes patient-facing AI-assisted features, including tools that organize information provided during booking or intake for a Provider's review, provide general health information, assist with Platform navigation or support, and assist a Provider in completing a form you need. For form completion, an AI-assisted service examines a blank form held in the Practice's own form library in order to locate the spaces to be completed and to propose which of the information the Practice already collects belongs in each. What is sent to that service is limited to the blank form's own printed labels and the position and shape of each space on the page, together with the names of the categories of information the Practice collects; no information about you is sent for this purpose, and a form you or a third party supplies is not examined in this way. A Provider reviews and accepts every proposed correspondence before any information is placed on a form, and signs the completed form. These features do not diagnose, prescribe, or make clinical decisions. General health information generated by an AI-assisted feature is informational only, is not medical advice, and does not create a provider-patient relationship. PHI is not used to train third-party AI models. If we introduce a materially new category of patient-facing AI-assisted feature, we will update this Policy and provide any notice or obtain any consent required by applicable law before the new processing begins.
When you access the Platform, we automatically collect certain technical information, including:
Our iOS mobile application may request the following device permissions:
An Android native application is in development; upon release, it will request similar permissions. Android users currently access the Platform via mobile web browser, which uses standard browser permission requests for camera and microphone access during consultations.
We do not access device permissions for purposes other than those described above.
We may receive information about you from third parties, including:
A medical practice on the Platform may send a person a link to one of its services when that person has asked the practice to send it to them. To do this, the practice gives us the person's name and an email address or a mobile number, and may add a short message of its own. The person sending it must confirm that the recipient asked for it, and we record that confirmation, the wording the sender was shown, and the date, together with the message.
We use this information only to send that one message and to show the recipient the page it links to. We record whether the message was sent by email, by text, or both, and whether and when the link was opened, so the practice can tell whether its reply arrived. We do not use it to send further messages, we do not add the recipient to any marketing list, we do not sell or share it, and we do not combine it with information from other sources to build a profile. The message identifies the practice and carries a link; it does not name the service.
If you receive such a message and did not ask for it, or you want your details removed, write to privacy@nextdaydoctor.com or support@nextdaydoctor.com. We will remove your contact details and disable the link. You do not need an account to make that request. You may stop text messages at any time by replying "STOP", whether or not you hold an account with us; a number that has opted out is not sent one of these messages.
An invitation of this kind is not a medical record and does not by itself make the recipient a patient of the practice. If the recipient goes on to book a visit, the information they provide at that point is covered by the rest of this Policy and by the Medical Practice's Notice of Privacy Practices.
Certain categories of personal information we collect are classified as "sensitive personal information" under applicable state privacy laws, including the California Privacy Rights Act ("CPRA"). These categories include:
We use sensitive personal information only as necessary to provide the services you request and as otherwise required or permitted by law. We do not use sensitive personal information for purposes of inferring characteristics unrelated to your care or for cross-context behavioral advertising.
We use the information we collect to:
We do not use PHI for marketing or advertising purposes.
Our Platform uses a criteria-based process to match patients with available healthcare providers. This matching process evaluates: (1) the state where you are located at the time of your request against providers' state license portfolios; (2) your preferred language; (3) the type of service requested; and (4) your age or the age of the patient, to determine whether pediatric or adult provider credentials are required.
The outcome of this matching process determines which providers are available to you. To the extent automated matching is implemented, the foregoing criteria govern which providers are presented to you. If you believe a matching result is incorrect or you have been unable to access care due to a matching outcome, please contact us at support@nextdaydoctor.com.
We use cookies, web beacons, and similar tracking technologies to collect information about your interactions with the Platform.
We do not currently use advertising cookies or deploy any cookies for the purpose of delivering advertisements or measuring advertising campaign effectiveness. If advertising cookies are introduced in the future, this Policy will be updated and, for California residents, a CPRA-compliant opt-out mechanism will be implemented before any such cookies are placed.
We use analytics service providers to understand how visitors interact with public portions of the Platform. These services may receive information such as pages visited, session duration, device or browser information, and general location. We configure analytics services not to receive PHI or health-related information, and we do not deploy general web analytics tools on authenticated pages or pages where PHI is present.
Most web browsers accept cookies by default. You may modify your browser settings to decline cookies; however, doing so may impair certain Platform functionality.
We currently do not respond to "Do Not Track" signals from browsers.
We may share your information in the following circumstances:
Practice-Level Data Isolation: If you are treated by more than one Practice using the Platform in the future, each Practice will maintain a separate, isolated view of your care with that Practice only.
We implement appropriate administrative, physical, and technical security measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Our security measures include encryption of data in transit and at rest, access controls, and regular security assessments.
However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.
Security of PHI: PHI transmitted through the Platform is encrypted. Secure messaging and telehealth sessions use encrypted channels. We do not send PHI through unencrypted email.
If we discover a potential breach involving PHI that we maintain for the Medical Practice, we will investigate, mitigate, and notify the Medical Practice in accordance with our Business Associate Agreement. The Medical Practice, as the affected Covered Entity, retains the final HIPAA breach determination and legal responsibility for notices to affected individuals, the U.S. Department of Health and Human Services, and, where required, the media. The Medical Practice may expressly delegate administrative tasks to us — including preparing, delivering, or submitting a notice on its behalf — but that delegation does not transfer the Medical Practice's responsibility for timely compliance.
For a breach of non-health personal information for which NDD MSO LLC is the legally responsible data owner or operator, we will provide notices required by applicable state data-breach notification laws. Where another organization is legally responsible for the affected information, we will notify and support that organization as required by law and contract.
We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.
PHI and Medical Records: The Medical Practice voluntarily retains Patient Records for at least ten (10) years from the later of the patient's last encounter to which the records relate or the receipt or production of the applicable record. HIPAA's six-year documentation rule is not a medical-record retention rule. A longer patient-jurisdiction, category-specific, payor, claim, investigation, or legal-hold period controls. Nevada records may not be destroyed while the person who is the subject of the records is under age twenty-three (23).
Service Invitations: Where a practice sends someone a link to one of its services at that person's request (Section 2.7), we retain the invitation record — the recipient's name and contact details, the sender's confirmation and the wording shown to them, which practice and which individual sent it, and whether and when the link was opened — for four (4) years from the date it was sent, the period that applies to records of consent for calls and text messages. A record of an opt-out or a removal request is retained for five (5) years, as the applicable rule requires. Where a recipient asks us to remove their contact details sooner, we remove the contact details and retain only the record that an invitation was sent and removed.
Non-Health Information: Account information and non-health personal data are retained for the duration of your account and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements.
When we no longer need your information and are not required to retain it, we will securely delete or anonymize it.
You may update or correct your account information at any time by logging into your account or contacting us at support@nextdaydoctor.com. Note that we may retain certain information under applicable medical-record laws, HIPAA documentation requirements, contracts, and preservation obligations even if you request deletion.
You may opt out of receiving promotional emails by following the unsubscribe instructions in those emails or by contacting us at support@nextdaydoctor.com. If you opt out, we may still send you non-promotional communications about your account, appointments, or legal notices.
You may opt out of SMS messages by replying "STOP" to any text message from us. You may disable push notifications through your device settings. Opting out of SMS or push notifications does not affect your ability to receive email communications.
We do not sell your personal information for money. We do not currently share your personal information with advertising partners for cross-context behavioral advertising. Accordingly, there is no active data-sharing program of this nature from which you need to opt out at this time.
If we introduce the practice of sharing personal information with advertising partners for cross-context behavioral advertising in the future, we will update this Policy and implement a CPRA-compliant opt-out mechanism before any such sharing begins. If you have questions about our data-sharing practices, you may contact us at privacy@nextdaydoctor.com.
You have the right to request correction of inaccurate personal information we hold about you. To submit a correction request, contact us at privacy@nextdaydoctor.com.
If you contact our support team by phone, voicemail messages and records of the interaction may be retained for quality assurance, training, security, and legal compliance purposes.
If a practice sent you a link to one of its services, you may ask us to remove your contact details and disable the link by contacting us at privacy@nextdaydoctor.com. You do not need an account to make this request, and we do not require you to explain it. See Section 2.7.
If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA"):
To exercise these rights, contact us at privacy@nextdaydoctor.com. We may need to verify your identity before processing your request. We will respond within 45 days as required by law, with an extension of up to 45 additional days where reasonably necessary.
If you are a Nevada resident, you have the right to opt out of the sale of certain covered information to third parties. While we do not currently sell covered information as defined under Nevada Revised Statutes § 603A, you may submit a verified opt-out request by contacting us at privacy@nextdaydoctor.com. We will respond within 60 days.
Residents of states with applicable comprehensive privacy or consumer health data laws may have rights concerning personal information or consumer health data that is not governed by HIPAA. Depending on the law and whether its applicability thresholds or exemptions are satisfied, those rights may include access, confirmation of processing, correction, deletion, portability, withdrawal of consent, restriction of certain sensitive-data processing, an appeal of a denied request, or an opt-out from sale, targeted advertising, or certain profiling.
We honor rights required by applicable law whether or not a state is named in this Policy. To submit a request or ask which rights apply to you, contact privacy@nextdaydoctor.com and identify your state of residence. We may take reasonable steps to verify your identity and authority before acting on a request. We will respond within the period required by applicable law and will provide appeal instructions when the applicable law requires an appeal process.
Before collecting, using, or sharing an additional category of consumer health data, or using consumer health data for a materially different purpose, we will update the applicable notice and obtain affirmative consent where required by law.
Account registration on the Platform is available only to individuals who are at least 18 years of age. The Platform does not permit minors to register accounts directly.
A parent or legal guardian may register an account and provide information about a minor dependent for the purpose of booking and managing the minor's healthcare appointments. In such cases, the parent or guardian is the account holder and is responsible for the accuracy and appropriate use of the minor's information. The minor's health information may constitute PHI and is handled accordingly.
If you are a parent or guardian and believe your child under 18 has provided personal information to us without your authorization, please contact us at support@nextdaydoctor.com so we can investigate and, where appropriate, delete such information.
The Platform may contain links to third-party websites or services not owned or controlled by NextDayDoctor. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit. Our disclosure of your information to third-party service providers is governed by Section 7 above and the applicable Business Associate Agreements.
We may update this Privacy Policy to reflect changes in law, our services, or our privacy practices. We will post the updated Policy and revise the "Last Updated" date. If a change is material, we will provide notice through reasonably appropriate channels, which may include email and an in-app notification for registered users. Where applicable law requires consent or authorization for new or materially different processing, we will obtain it before that processing begins. This Policy describes our practices and does not make consent unnecessary where consent is required by law.
For questions about this Privacy Policy, to exercise your privacy rights, or to report a privacy concern, please contact us at:
NDD MSO LLC (DBA NextDayDoctor) Email: privacy@nextdaydoctor.com Address: 9205 West Russell Road, Suite 240, Las Vegas, Nevada 89148
If you would like to receive a printed copy of this Privacy Policy, you may request one by sending a written request to privacy@nextdaydoctor.com. We will provide a printed copy at no charge.
For matters specifically related to your medical records or PHI, please also contact the Medical Practice as directed in the Notice of Privacy Practices.
This Privacy Policy is governed by applicable federal law and, to the extent not preempted, the laws of the State of Nevada without regard to conflict-of-law principles. Contractual disputes concerning access to or use of the Platform are governed by the dispute-resolution provisions of the Terms of Service to the extent those provisions are enforceable and apply to the claim. Nothing in this Policy limits any non-waivable right, any right to seek relief available under applicable privacy or consumer health data law, or any right to file a complaint with a federal or state regulator, attorney general, professional licensing board, or data protection authority.